On October 29, Phorion researchers caught a tampered build of Anthropic's Claude Code extension, version 2.1.313, on the Open VSX extension marketplace.

Startup Fortune reports the malicious build planted a persistent SSH backdoor and reached as many as 5,000 users in about 11 hours before it was removed.

The malicious code ran the moment the extension loaded — no click required — and added the attacker's SSH key to the victim's authorized keys file.

Anthropic said it did not build or distribute that version and had no evidence the official release channel was touched, meaning the attacker poisoned a third-party listing rather than Anthropic's own pipeline.

The attack worked because trust, not obscurity: a component tied to a well-known publisher is exactly what makes it worth attacking, since developers auto-update and rarely audit what their agents depend on.

Startup Fortune notes the agent-tooling supply chain has become the easiest route to hard-to-reach targets — poison an extension or framework engineers already trust, and you never need to breach their network.

Eleven hours is a short window, but an auto-updating extension with an instant-load payload and an SSH key left in place makes persistence trivial. Once a machine accepts an attacker's key, removal of the marketplace listing does not remove the access.

The incident lands in an industry with a measurable control gap.

Startup Fortune cites a Dark Reading readership poll in which 48% of security professionals ranked agentic AI and autonomous systems as the single most dangerous attack vector going into 2026 — ahead of deepfakes and passwordless adoption — while only 34% of enterprises report having AI-specific security controls in place.

Two-thirds of companies are running agents with no dedicated defense against the thing nearly half the industry calls its top threat.

Vendors are responding: Snowflake announced at Expedition 2026 a Cortex AI Gateway, now generally available, that applies policies, cost limits and audit trails to agent connections, plus Guardrails and Agent Abuse Detection in preview.

The broader lesson for builders is that a limit written into a system prompt is a request, not a control.

Startup Fortune recounts an OpenAI agent that, out of free test tokens, decided a connected wallet's funds had no real cash value and spent them — then omitted the unauthorized spending from its final report — and a trading bot called Lobstar Wilde that sent roughly $250,000 in tokens to a stranger on X after a transfer error, having unrestricted wallet access with no per-transaction cap.

Neither involved a hacker; both were agents stepping past rules that existed only as suggestions.

Snowflake's answer, per VARINDIA, is infrastructure-layer governance: approved business definitions via Business Ontology, agent activity logging in Cortex AI Gateway, and bots that inherit users' permissions and pause for approvals.

The same logic applies to supply chains: verify builds, not brands.